log description = "BGP neighbor status changed"

Forum|Forum|5 years ago
November 19, 2020
3 replies
13669 views

When I check Fortianalyzer router events, I can see lots of "BGP neighbor status changed" events that my neighbors are down in for example last 4 hours. But when I do "get router info bgp neighbours" on Fortigate, I can see that my neighbours where up for 11 hours or so. is there any explanation for this?

emnoc

New Member

Will fortianalyzer just reads the logs from your firewall it does not magically create a log ;)

Let's try this;

1st clear any filters on the said device via the cli

execute log filter reset

now set a filter for the following message;

execute log filter field logdesc "BGP neighbor status changed"

execute log filter category 1

and now display all logs;

execute log display

Do you show any log messages? What time ? What neighbor ? etc.... Also make sure your FGT clock is correct

get system status

Ken Felix

DaryayaAuthor

Visitor III

thanks for this.

When I do 'execute log display' it only displays log for the last 30 minutes or so but on Fortianalyzer I do logs for the last 4 hours and I see bgp status changes, I cant see them on firewall.

emnoc

New Member

Then something is wrong but your probably reading from memory.

Do the following from cli

execute log filter device ?

You should see a output similar;

FGTWPBHFLA # execute log filter device Available devices: 0: memory 1: fortianalyzer 2: fortianalyzer-cloud 3: forticloud

If you selected #1 and or whatever it is on your device and repeat the earlier commands you would read the logs from the FAZ. BUt back to your logs and the bgp status can you export the logs from the FAZ and confirm the neighbor and devid ( just thinking out loud ) . The logs had to be sent to the FAZ from the device.

The "get router info bgp summary" will show you how long the peer has been established and you go backwards to find the time range for the corresponding logs.

Or

FGTWPBHFLA # get router info bgp neighbors | grep Est BGP state = Established, up for 10:56:18

NOTE: the remote bgp-peer was rebooted 10+ hours ago for the above example

Ken Felix

Sign up

Login with SSO

Login to the community

Login with SSO